[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF7LeTOuTHVAxOlBjCpe4VwQmOXMHK0SWabB598OT2aI":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3bb77f1e-a35a-4bb9-8c54-defedcc74915","Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation","dutch-police-arrest-24-year-old-amsterdam-man-in-shinyhunters-investigation-b8f949","Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. \"It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters,\" the Politie Landelijke Opsporing en Interventies said in an X post Monday. Police said the individual is expected to appear before the","Dutch authorities arrested a 24-year-old Amsterdam resident identified as Pepijn van der Stap (aka Umbreon) in connection with the ShinyHunters hacking group. Van der Stap, previously arrested in 2023 for data theft and extortion, was working as an offensive security lead at Neo Security while allegedly conducting illicit activities. The arrest comes as ShinyHunters claimed responsibility for breaching the FBI's job application portal and stealing terabytes of sensitive data, claiming the attack was a marketing campaign rather than extortion.","Dutch police arrest 24-year-old Amsterdam man linked to ShinyHunters hacker group.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fdutch-police-arrest-24-year-old.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgWsGNpV8Y5_YLcyxRYju8E3caiN3I3Zttrlvxhz5iXfzVIR_Ayp_d_Zn2Wk12ZBkz5nW4eYfKeEs-xxs9kYuS_paAwO3wJleeUxdMRbrbU_lXwWVuG7ajiFH0UOEcoj3almps5b54DXt-mGy73GhXjCQzGsNNDJkhdfJXRI9XWeFF5hfsr4zjQty-Wued5\u002Fs1600\u002F1000111943.jpg","2026-09-29T08:35:10+00:00","2026-09-29T10:00:21.544059+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Pepijn van der Stap (aka Umbreon)",{"name":23,"type":24},"Oracle","vendor",{"name":26,"type":27},"Oracle PeopleSoft","product",{"name":29,"type":24},"Neo Security",{"name":31,"type":24},"Hadrian","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-35273","Oracle PeopleSoft vulnerability allegedly exploited by ShinyHunters; bypassed via URL-encoding trick",[23,29,31],{"controls":60,"vendors":147},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":52,"name":91,"problem":92,"products":93},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":119,"name":120,"problem":121,"products":122},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[148],{"slug":149,"name":23,"logo_path":150,"roles":151},"oracle","\u002Fvendor-logos\u002Foracle.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":168},"insider-threat-security-professional-moonlighting-as-cybercriminal","Insider Threat: Security Professional Moonlighting as Cybercriminal","Van der Stap's case illustrates a dangerous insider threat scenario where a trusted offensive security professional allegedly leveraged his privileged knowledge and access to conduct criminal activity. Organizations hiring security personnel — especially those with prior criminal records — must implement rigorous background screening and continuous behavioral monitoring. The dual role of 'defender by day, attacker by night' highlights how access to sensitive systems and security tooling can be weaponized from within. This case also underscores that threat actors within the ShinyHunters group are not anonymous outsiders but may be embedded inside legitimate organizations, making supply chain and personnel vetting critical controls.",[158,159,160,161,162,163,164,165,166,167],"CIS Control 6 - Access Control Management","CIS Control 14 - Security Awareness and Skills Training","CIS Control 17 - Incident Response Management","NIST SP 800-53 AC-2 - Account Management","NIST SP 800-53 PS-3 - Personnel Screening","NIST SP 800-53 AT-2 - Literacy Training and Awareness","NIST Insider Threat Guide (SP 800-53 IR-6)","ISO 27001 Annex A.7 - Human Resource Security","GDPR Article 32 - Security of Processing","ITIL - Service Transition: Change and Access Management",{}]